Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2009-4037

Опубликовано: 20 нояб. 2009
Источник: nvd
CVSS2: 7.5
EPSS Низкий

Описание

Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7, and 2.2.x before 2.2 RC, allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) admin/db/users_db.inc, and various other .inc and .php files under (2) admin/, (3) dimensions/, (4) gl/, (5) inventory/, (6) manufacturing/, and (7) purchasing/.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:frontaccounting:frontaccounting:*:*:*:*:*:*:*:*
Версия до 2.1.6 (включая)
cpe:2.3:a:frontaccounting:frontaccounting:2.0:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.0.5:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.0.7:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.1:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.1.0:beta:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.1.0:beta_2:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.1.0:rc:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.1.2:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.1.4:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.1.5:*:*:*:*:*:*:*
cpe:2.3:a:frontaccounting:frontaccounting:2.2:beta:*:*:*:*:*:*

EPSS

Процентиль: 72%
0.00706
Низкий

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

github логотип

GHSA-rf54-w24v-682q

github
почти 4 года назад

Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7, and 2.2.x before 2.2 RC, allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) admin/db/users_db.inc, and various other .inc and .php files under (2) admin/, (3) dimensions/, (4) gl/, (5) inventory/, (6) manufacturing/, and (7) purchasing/.

EPSS

Процентиль: 72%
0.00706
Низкий

7.5 High

CVSS2

Дефекты

CWE-89